Add per lambda IAM to config
diff --git a/lambdas/scale_out_runner/.chalice/config.json b/lambdas/scale_out_runner/.chalice/config.json index bd29d8c..89efd5f 100644 --- a/lambdas/scale_out_runner/.chalice/config.json +++ b/lambdas/scale_out_runner/.chalice/config.json
@@ -8,10 +8,13 @@ "prod": { "api_gateway_stage": "api", "autogen_policy": false, - "iam_policy_file": "prod_iam.json", "environment_variables": { "GH_WEBHOOK_TOKEN_ENCRYPTED": "AQICAHg1MGVq8MAqYXSkkgy6iL19KSI14nJw8DelmHFuRpAfvQEh/mniWicOD0N1aVuHhp+VAAAAfDB6BgkqhkiG9w0BBwagbTBrAgEAMGYGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMVqkAu70BaR2rDQ4qAgEQgDlIAxDrBlblL6XNKkJIs+zrNEMcGpS68JnoVh2s1oKEzbBXzYS16/9ZrW9CwUV4ULAd2EsGb90iz74=", "ACTIONS_SQS_URL": "https://sqs.eu-central-1.amazonaws.com/827901512104/actions-runner-requests" + }, + "lambda_functions": { + "index": { "iam_policy_file": "prod/index.json" }, + "sync_committers": { "iam_policy_file": "prod/sync_committers.json" } } } },
diff --git a/lambdas/scale_out_runner/.chalice/prod_iam.json b/lambdas/scale_out_runner/.chalice/prod/index.json similarity index 92% rename from lambdas/scale_out_runner/.chalice/prod_iam.json rename to lambdas/scale_out_runner/.chalice/prod/index.json index 539bac3..c7b4fe3 100644 --- a/lambdas/scale_out_runner/.chalice/prod_iam.json +++ b/lambdas/scale_out_runner/.chalice/prod/index.json
@@ -2,7 +2,7 @@ "Version": "2012-10-17", "Statement": [ { - "Sid": "VisualEditor0", + "Sid": "ScaleOutRunner", "Effect": "Allow", "Action": [ "logs:CreateLogStream", @@ -22,7 +22,7 @@ ] }, { - "Sid": "VisualEditor1", + "Sid": "ScaleOutRunner", "Effect": "Allow", "Action": [ "autoscaling:DescribeAutoScalingGroups"
diff --git a/lambdas/scale_out_runner/.chalice/prod/sync_committers.json b/lambdas/scale_out_runner/.chalice/prod/sync_committers.json new file mode 100644 index 0000000..351e590 --- /dev/null +++ b/lambdas/scale_out_runner/.chalice/prod/sync_committers.json
@@ -0,0 +1,24 @@ +{ + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "SyncCommitters", + "Effect": "Allow", + "Action": [ + "kms:Decrypt", + "kms:Encrypt", + "kms:GenerateDataKey", + "ssm:GetParameter", + "ssm:PutParameter", + "logs:CreateLogStream", + "logs:CreateLogGroup", + "logs:PutLogEvents" + ], + "Resource": [ + "arn:aws:ssm:*:827901512104:parameter/runners/*/configOverlay", + "arn:aws:kms:*:827901512104:key/48a58710-7ac6-4f88-995f-758a6a450faa", + "arn:*:logs:*:*:*" + ] + } + ] +}